Implement OAuth2 provider (#927)

- [x] Application management
  - [x] Link
  - [ ] Tests
- [x] Authorize flow
  - [x] Tests
- [x] Refresh token handling
  - [x] Tests
- [x] Revocation endpoint
  - [x] Tests
  - [x] Mitigate: https://github.com/jazzband/django-oauth-toolkit/issues/585
- [x] API authenticator / permission driver
  - [x] Test
- [x] Enforce organizer restriction
  - [x] Tests
- [x] Enforce scope restriction
  - [x] Tests
- [x] Show current applications to user
  - [x] Revoke
  - [x] Tests
- [x] Log new authorizations
  - [x] notify user
- [x] Ensure other grant types are not available
- [x] Documentation
- [x] check if revoking access toking, then refreshing gets rid of organizer constraint
- [x] Show logentry foo

src/pretix/api/auth/permission.py

@@ -1,5 +1,6 @@
 from rest_framework.permissions import SAFE_METHODS, BasePermission
 
+from pretix.api.models import OAuthAccessToken
 from pretix.base.models import Event
 from pretix.base.models.organizer import Organizer, TeamAPIToken
 from pretix.helpers.security import (
@@ -55,6 +56,15 @@ class EventPermission(BasePermission):
 
             if required_permission and required_permission not in request.orgapermset:
                 return False
+
+        if isinstance(request.auth, OAuthAccessToken):
+            if not request.auth.allow_scopes(['write']) and request.method not in SAFE_METHODS:
+                return False
+            if not request.auth.allow_scopes(['read']) and request.method in SAFE_METHODS:
+                return False
+        if isinstance(request.auth, OAuthAccessToken) and hasattr(request, 'organizer'):
+            if not request.auth.organizers.filter(pk=request.organizer.pk).exists():
+                return False
         return True